Public key infrastructure delegation

A method of verifying a client in a multi-tier network system, comprising the steps of:

• initiating communications between the client and a first tier server;
• building a first certification data structure comprised of a certificate of the client and a digital signature of the first certification data structure, wherein the digital signature is encrypted by a private key of the client, and wherein the first certification data structure does not include programmatic content;
• sending the first certification data structure to the first tier server;
• initiating communications between the first tier server and a second tier server on behalf of the client;
• building a second certificate data structure that comprises the first certificate data structure, wherein the second certification data structure does not include programmatic content;
• sending the second certification data structure to the second tier server;
• in the second server, extracting a public key of the first tier server from the second certificate data structure;
• in the second server, decrypting a digital signature of the second certification data structure through use of the public key of the first server and checking the validity of the digital signature of the second certification data structure;
• in the second server, extracting a public key of the client from the first certificate data structure;
• in the second server, verifying the client by decrypting a digital signature of the first certification data structure through use of the public key of the client and checking the validity of the digital signature of the first certification data structure.

A computer-readable medium having a data structure containing certification data built by an nth node in a computer network, the data structure having the following fields:

• a first data field containing a certificate of a first network node;
• a second data field containing a certificate of a second network node;
• a third data field containing an expiration time stamp;
• a fourth data field containing a maximum node depth;
• a fifth data field containing a nested data structure built by an n−1th node in the computer network;
• and
• a sixth field containing a digital signature of the first, second, third, fourth, and fifth data fields encrypted by a private key of the first network node,
• wherein the data structure does not include programmatic content.

A computer-readable medium containing a program that allows an end node to verify a client of an intermediate node when the intermediate node is in communication with the end node, the program comprising:

• means for opening a certification data structure created by the client, wherein the certification data structure does not include programmatic content;
• means for extracting a public key of the client from the certification data structure;
• and
• means for verifying a signature of the certification data structure.

A network system having a certification system, comprising:

• a plurality of sequential nodes 1 . . . M, wherein each node n within the plurality of sequential nodes includes a system for securely communicating with an nth+1 node on behalf of any earlier node 1 . . . (n−1);
• a certification program stored on a computer readable medium, and executable by the nth+1 node to verify any of the earlier nodes by examining a certification data structure built by the nth node, wherein the certification data structure built by the nth node does not include programmatic content, and wherein the certification program comprises:
• a mechanism for opening the certification data structure created by the nth node;
• a mechanism for extracting a public key of the nth node from the certification data structure;
• and
• a mechanism for verifying a signature of the certification data structure.

A network system having a verification system, comprising:

• a plurality of sequential nodes 1 . . . M, wherein nodes 1 and 2 can securely communicate using an asymmetric security protocol, and wherein each node 2-M can securely communicate with an adjacent node with using a symmetric security protocol with a previously agreed to signing key;
• a verification program stored on a computer readable medium and executable by a node P to verify node 1 by examining a certification data structure built by the P−1 node, wherein the certification data structure built by the P−1 node does not include programmatic content, and wherein node P resides within nodes 3 . . . M, and wherein the certification program comprises:
• a mechanism for extracting a public key of node 1 from the certification data structure;
• and
• a mechanism for verifying a signature of the certification data structure.